Adding metadata

13 files changed, 518 insertions, 0 deletions

diff --git a/sys-apps/apparmor/Manifest b/sys-apps/apparmor/Manifest
new file mode 100644
index 000000000000..055463ac9a28
--- /dev/null
+++ b/sys-apps/apparmor/Manifest
@@ -0,0 +1,3 @@
+DIST apparmor-3.1.4.tar.gz 7965268 BLAKE2B a9be29a42bb96c1d2c69a6b7627d59aea023f22fe79bff1a487aa5ddd6845ec98f67be5c597ec51edf4493513dfed3b43fc493f454bcf48b3f43c44572ffc2ae SHA512 db65edfa1b9c1f953940165e71dddcab9a2d378f29683b0b4e5d44f0810bb0105ba3820ba89de927ef90d0a94ea6d61e91ce3de09ec2e385817735a93d4039c4
+DIST apparmor-4.0.3.tar.gz 8211339 BLAKE2B 715391a1fc0fb57b820a8bcebdc76ae96e436a29546b9c47019f10f4d22942431ba5c878d92bb61b47ff17012e026195b8d7d78a329cc1cc182a31bc3b512e63 SHA512 8b1240ec56fe4f987edcda9380de685e36f4ac931772e980a8f3655dfbfd7e337a4b15227c7ceecb87d9a2bb592e466ec39912ef8f2fa59f8802464d72df8da2
+DIST apparmor-v4.1.7.tar.bz2 5861899 BLAKE2B 00f881cbe989a686fbc7c0f6178b8b1892767378bb8da79a4656a8abfb222212037751e7c2ce2ca558c1ca2398684452ad10056b7e3eb1dd354155dbe688f78d SHA512 ac39de21042be5c85c1cac07082444772b506e0701ec0d3300d5515f14b3673a485ab37aeb38e3533a236b03ecf9a0e1032bbdd296e878e68b93472ebc8fd1ae
diff --git a/sys-apps/apparmor/apparmor-3.1.4-r2.ebuild b/sys-apps/apparmor/apparmor-3.1.4-r2.ebuild
new file mode 100644
index 000000000000..2e87cb1c0fdf
--- /dev/null
+++ b/sys-apps/apparmor/apparmor-3.1.4-r2.ebuild
@@ -0,0 +1,95 @@
+# Copyright 1999-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit flag-o-matic systemd toolchain-funcs
+
+MY_PV="$(ver_cut 1-2)"
+
+DESCRIPTION="Userspace utils and init scripts for the AppArmor application security system"
+HOMEPAGE="https://gitlab.com/apparmor/apparmor/wikis/home"
+SRC_URI="https://launchpad.net/${PN}/${MY_PV}/${PV}/+download/${PN}-${PV}.tar.gz"
+
+LICENSE="GPL-2"
+SLOT="0"
+KEYWORDS="amd64 arm64 ~ppc64 ~riscv"
+IUSE="doc"
+
+# Was restricted previously b/c needs apparmor support in kernel
+# TODO: add check to ebuild
+#RESTRICT="test" # bug 675854
+
+RDEPEND="~sys-libs/libapparmor-${PV}"
+DEPEND="${RDEPEND}"
+BDEPEND="
+	dev-lang/perl
+	sys-apps/which
+	app-alternatives/yacc
+	sys-devel/gettext
+	app-alternatives/lex
+	doc? ( dev-tex/latex2html )
+"
+
+S=${WORKDIR}/apparmor-${PV}/parser
+
+PATCHES=(
+	"${FILESDIR}/${PN}-3.0.5-makefile.patch"
+	"${FILESDIR}/${PN}-2.11.1-dynamic-link.patch"
+	"${FILESDIR}/${PN}-3.1.4-fix-hardcoded-path.patch"
+)
+
+src_prepare() {
+	default
+
+	# remove warning about missing file that controls features
+	# we don't currently support
+	sed -e "/installation problem/ctrue" -i rc.apparmor.functions || die
+
+	# bug 634782
+	sed -e "s/cpp/$(tc-getCPP) -/" \
+		-i ../common/list_capabilities.sh \
+		-i ../common/list_af_names.sh || die
+}
+
+src_configure() {
+	# ODR violations (bug #863524)
+	filter-lto
+
+	default
+}
+
+src_compile() {
+	emake \
+		AR="$(tc-getAR)" \
+		CC="$(tc-getCC)" \
+		CPP="$(tc-getCPP) -" \
+		CXX="$(tc-getCXX)" \
+		USE_SYSTEM=1 \
+		arch manpages
+	use doc && emake pdf
+}
+
+src_test() {
+	emake CXX="$(tc-getCXX)" USE_SYSTEM=1 check
+}
+
+src_install() {
+	emake \
+		CPP="$(tc-getCPP) -" \
+		DESTDIR="${D}" \
+		DISTRO="unknown" \
+		USE_SYSTEM=1 \
+		install
+
+	dodir /etc/apparmor.d/disable
+
+	newinitd "${FILESDIR}/${PN}-init-1" ${PN}
+	systemd_newunit "${FILESDIR}/apparmor.service" apparmor.service
+
+	use doc && dodoc techdoc.pdf
+
+	exeinto /usr/share/apparmor
+	doexe "${FILESDIR}/apparmor_load.sh"
+	doexe "${FILESDIR}/apparmor_unload.sh"
+}
diff --git a/sys-apps/apparmor/apparmor-4.0.3.ebuild b/sys-apps/apparmor/apparmor-4.0.3.ebuild
new file mode 100644
index 000000000000..6f5e36aa0496
--- /dev/null
+++ b/sys-apps/apparmor/apparmor-4.0.3.ebuild
@@ -0,0 +1,102 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit flag-o-matic systemd toolchain-funcs linux-info
+
+MY_PV="$(ver_cut 1-2)"
+
+DESCRIPTION="Userspace utils and init scripts for the AppArmor application security system"
+HOMEPAGE="https://gitlab.com/apparmor/apparmor/wikis/home"
+SRC_URI="https://launchpad.net/${PN}/${MY_PV}/${PV}/+download/${PN}-${PV}.tar.gz"
+S=${WORKDIR}/apparmor-${PV}/parser
+
+LICENSE="GPL-2"
+SLOT="0"
+KEYWORDS="amd64 arm64 ~ppc64 ~riscv"
+IUSE="doc"
+
+# Was restricted previously b/c needs apparmor support in kernel
+# TODO: add check to ebuild
+#RESTRICT="test" # bug 675854
+
+RDEPEND="~sys-libs/libapparmor-${PV}"
+DEPEND="${RDEPEND}"
+BDEPEND="
+	dev-lang/perl
+	sys-apps/which
+	app-alternatives/yacc
+	sys-devel/gettext
+	app-alternatives/lex
+	doc? ( dev-tex/latex2html )
+"
+CONFIG_CHECK="SECURITY_APPARMOR"
+
+PATCHES=(
+	"${FILESDIR}/${PN}-4.0.3-convert-uint-to-unsigned-int.patch"
+)
+
+src_prepare() {
+	default
+
+	sed -e '/^AALIB =/ s/-Bstatic/-Bdynamic/' -i Makefile || die
+
+	# Install rc.apparmor.functions to Gentoo-appropriate location
+	sed -e '/install-indep: indep/a\\tinstall -m 755 -d ${DESTDIR}/usr/libexec' -i Makefile || die
+	sed -e 's:rc.apparmor.functions $(APPARMOR_BIN_PREFIX):rc.apparmor.functions ${DESTDIR}/usr/libexec:' \
+		-i Makefile || die
+	sed -e ':^APPARMOR_FUNCTIONS=: s:/lib/apparmor/:/usr/libexec/:' -i apparmor.systemd || die
+	sed -e 's:\. /lib/apparmor/rc.apparmor.functions:\. /usr/libexec/rc.apparmor.functions:' -i profile-load || die
+
+	# remove warning about missing file that controls features
+	# we don't currently support
+	sed -e "/installation problem/ctrue" -i rc.apparmor.functions || die
+
+	# bug 634782
+	sed -e "s/cpp/$(tc-getCPP) -/" \
+		-i ../common/list_capabilities.sh \
+		-i ../common/list_af_names.sh || die
+}
+
+src_configure() {
+	# ODR violations (bug #863524)
+	filter-lto
+
+	default
+}
+
+src_compile() {
+	emake \
+		AR="$(tc-getAR)" \
+		CC="$(tc-getCC)" \
+		CPP="$(tc-getCPP) -" \
+		CXX="$(tc-getCXX)" \
+		USE_SYSTEM=1 \
+		arch manpages
+	use doc && emake pdf
+}
+
+src_test() {
+	emake CXX="$(tc-getCXX)" USE_SYSTEM=1 check -Onone
+}
+
+src_install() {
+	emake \
+		CPP="$(tc-getCPP) -" \
+		DESTDIR="${D}" \
+		DISTRO="unknown" \
+		USE_SYSTEM=1 \
+		install
+
+	dodir /etc/apparmor.d/disable
+
+	newinitd "${FILESDIR}/${PN}-init-1" ${PN}
+	systemd_newunit "${FILESDIR}/apparmor.service" apparmor.service
+
+	use doc && dodoc techdoc.pdf
+
+	exeinto /usr/share/apparmor
+	doexe "${FILESDIR}/apparmor_load.sh"
+	doexe "${FILESDIR}/apparmor_unload.sh"
+}
diff --git a/sys-apps/apparmor/apparmor-4.1.7.ebuild b/sys-apps/apparmor/apparmor-4.1.7.ebuild
new file mode 100644
index 000000000000..0d270a2827d6
--- /dev/null
+++ b/sys-apps/apparmor/apparmor-4.1.7.ebuild
@@ -0,0 +1,99 @@
+# Copyright 1999-2026 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit flag-o-matic systemd toolchain-funcs linux-info
+
+MY_PV="$(ver_cut 1-2)"
+
+DESCRIPTION="Userspace utils and init scripts for the AppArmor application security system"
+HOMEPAGE="https://gitlab.com/apparmor/apparmor/wikis/home"
+SRC_URI="https://gitlab.com/apparmor/apparmor/-/archive/v${PV}/${PN}-v${PV}.tar.bz2"
+
+S=${WORKDIR}/apparmor-v${PV}/parser
+
+LICENSE="GPL-2"
+SLOT="0"
+KEYWORDS="~amd64 ~arm64 ~ppc64 ~riscv"
+IUSE="doc"
+
+# Was restricted previously b/c needs apparmor support in kernel
+# TODO: add check to ebuild
+#RESTRICT="test" # bug 675854
+
+RDEPEND="~sys-libs/libapparmor-${PV}"
+DEPEND="${RDEPEND}"
+BDEPEND="
+	dev-lang/perl
+	sys-apps/which
+	app-alternatives/yacc
+	sys-devel/gettext
+	app-alternatives/lex
+	doc? ( dev-tex/latex2html )
+"
+CONFIG_CHECK="SECURITY_APPARMOR"
+
+src_prepare() {
+	default
+
+	sed -e '/^AALIB =/ s/-Bstatic/-Bdynamic/' -i Makefile || die
+
+	# Install rc.apparmor.functions to Gentoo-appropriate location
+	sed -e '/install-indep: indep/a\\tinstall -m 755 -d ${DESTDIR}/usr/libexec' -i Makefile || die
+	sed -e 's:rc.apparmor.functions $(APPARMOR_BIN_PREFIX):rc.apparmor.functions ${DESTDIR}/usr/libexec:' \
+		-i Makefile || die
+	sed -e ':^APPARMOR_FUNCTIONS=: s:/lib/apparmor/:/usr/libexec/:' -i apparmor.systemd || die
+	sed -e 's:\. /lib/apparmor/rc.apparmor.functions:\. /usr/libexec/rc.apparmor.functions:' -i profile-load || die
+
+	# remove warning about missing file that controls features
+	# we don't currently support
+	sed -e "/installation problem/ctrue" -i rc.apparmor.functions || die
+
+	# bug 634782
+	sed -e "s/cpp/$(tc-getCPP) -/" \
+		-i ../common/list_capabilities.sh \
+		-i ../common/list_af_names.sh || die
+}
+
+src_configure() {
+	# ODR violations (bug #863524)
+	filter-lto
+
+	default
+}
+
+src_compile() {
+	emake \
+		AR="$(tc-getAR)" \
+		CC="$(tc-getCC)" \
+		CPP="$(tc-getCPP) -" \
+		CXX="$(tc-getCXX)" \
+		USE_SYSTEM=1 \
+		arch manpages
+	use doc && emake pdf
+}
+
+src_test() {
+	emake CXX="$(tc-getCXX)" USE_SYSTEM=1 check -Onone
+}
+
+src_install() {
+	emake \
+		CPP="$(tc-getCPP) -" \
+		DESTDIR="${D}" \
+		DISTRO="unknown" \
+		USE_SYSTEM=1 \
+		install
+
+	dodir /etc/apparmor.d/disable
+
+	newinitd "${FILESDIR}/${PN}-init-1" ${PN}
+	systemd_newunit "${FILESDIR}/apparmor.service" apparmor.service
+
+	use doc && dodoc techdoc.pdf
+
+	exeinto /usr/share/apparmor
+	doexe "${FILESDIR}/apparmor_load.sh"
+	doexe "${FILESDIR}/apparmor_unload.sh"
+}
diff --git a/sys-apps/apparmor/files/apparmor-2.11.1-dynamic-link.patch b/sys-apps/apparmor/files/apparmor-2.11.1-dynamic-link.patch
new file mode 100644
index 000000000000..bde21c30e703
--- /dev/null
+++ b/sys-apps/apparmor/files/apparmor-2.11.1-dynamic-link.patch
@@ -0,0 +1,11 @@
+--- a/Makefile
++++ b/Makefile
+@@ -87,7 +87,7 @@
+ AAREOBJECT = ${AAREDIR}/libapparmor_re.a
+ AAREOBJECTS = $(AAREOBJECT)
+ AARE_LDFLAGS = -static-libgcc -static-libstdc++ -L. $(LDFLAGS)
+-AALIB = -Wl,-Bstatic -lapparmor -Wl,-Bdynamic -lpthread
++AALIB = -Wl,-Bdynamic -lapparmor -Wl,-Bdynamic -lpthread
+ 
+ ifdef USE_SYSTEM
+   # Using the system libapparmor so Makefile dependencies can't be used
diff --git a/sys-apps/apparmor/files/apparmor-3.0.5-makefile.patch b/sys-apps/apparmor/files/apparmor-3.0.5-makefile.patch
new file mode 100644
index 000000000000..5d4dd9c57e12
--- /dev/null
+++ b/sys-apps/apparmor/files/apparmor-3.0.5-makefile.patch
@@ -0,0 +1,18 @@
+* Avoid installing empty /var/lib/apparmor
+* Install rc.apparmor.functions to Gentoo-appropriate location
+
+--- a/Makefile
++++ b/Makefile
+@@ -407,10 +407,10 @@
+ .PHONY: install-indep
+ install-indep: indep
+ 	install -m 755 -d $(INSTALL_CONFDIR)
++	install -m 755 -d ${DESTDIR}/usr/libexec
+ 	install -m 644 parser.conf $(INSTALL_CONFDIR)
+-	install -m 755 -d ${DESTDIR}/var/lib/apparmor
+ 	install -m 755 -d $(APPARMOR_BIN_PREFIX)
+-	install -m 755 rc.apparmor.functions $(APPARMOR_BIN_PREFIX)
++	install -m 755 rc.apparmor.functions ${DESTDIR}/usr/libexec
+ 	install -m 755 profile-load $(APPARMOR_BIN_PREFIX)
+ 	$(MAKE) -C po install NAME=${NAME} DESTDIR=${DESTDIR}
+ 
diff --git a/sys-apps/apparmor/files/apparmor-3.1.4-fix-hardcoded-path.patch b/sys-apps/apparmor/files/apparmor-3.1.4-fix-hardcoded-path.patch
new file mode 100644
index 000000000000..6e7c83d766e4
--- /dev/null
+++ b/sys-apps/apparmor/files/apparmor-3.1.4-fix-hardcoded-path.patch
@@ -0,0 +1,34 @@
+https://bugs.gentoo.org/895302
+--- a/apparmor.systemd
++++ b/apparmor.systemd
+@@ -15,7 +15,7 @@
+ #    along with this program; if not, contact Novell, Inc.
+ # ----------------------------------------------------------------------
+ 
+-APPARMOR_FUNCTIONS=/lib/apparmor/rc.apparmor.functions
++APPARMOR_FUNCTIONS=/usr/libexec/rc.apparmor.functions
+ 
+ aa_action()
+ {
+--- a/profile-load
++++ b/profile-load
+@@ -21,7 +21,7 @@
+ 
+ [ -z "$1" ]                  && exit 1 # require a profile name
+ 
+-. /lib/apparmor/rc.apparmor.functions
++. /usr/libexec/rc.apparmor.functions
+ 
+ # do not load in a container
+ if [ -x /usr/bin/systemd-detect-virt ] && \
+--- a/rc.apparmor.slackware
++++ b/rc.apparmor.slackware
+@@ -18,7 +18,7 @@
+ # rc.apparmor by Steve Beattie
+ #
+ # /etc/rc.d/rc.apparmor
+-APPARMOR_FUNCTIONS=/lib/apparmor/rc.apparmor.functions
++APPARMOR_FUNCTIONS=/usr/libexec/rc.apparmor.functions
+ 
+ aa_action() {
+ 	STRING=$1
diff --git a/sys-apps/apparmor/files/apparmor-4.0.3-convert-uint-to-unsigned-int.patch b/sys-apps/apparmor/files/apparmor-4.0.3-convert-uint-to-unsigned-int.patch
new file mode 100644
index 000000000000..bcdd95d8c4b6
--- /dev/null
+++ b/sys-apps/apparmor/files/apparmor-4.0.3-convert-uint-to-unsigned-int.patch
@@ -0,0 +1,37 @@
+inspired by upstream fix in commit ff03702fdebb6c6c55532a6768b404706823c339
+https://gitlab.com/apparmor/apparmor/-/commit/ff03702fdebb6c6c55532a6768b404706823c339
+
+diff --git a/parser/rule.h b/parser/rule.h
+index 05dbed1..e041f31 100644
+--- a/rule.h
++++ b/rule.h
+@@ -208,13 +208,13 @@ public:
+ 	}
+ 
+ 	int cmp(prefixes const &rhs) const {
+-		if ((uint) audit < (uint) rhs.audit)
++		if ((unsigned int) audit < (unsigned int) rhs.audit)
+ 			return -1;
+-		if ((uint) audit > (uint) rhs.audit)
++		if ((unsigned int) audit > (unsigned int) rhs.audit)
+ 			return 1;
+-		if ((uint) rule_mode < (uint) rhs.rule_mode)
++		if ((unsigned int) rule_mode < (unsigned int) rhs.rule_mode)
+ 			return -1;
+-		if ((uint) rule_mode > (uint) rhs.rule_mode)
++		if ((unsigned int) rule_mode > (unsigned int) rhs.rule_mode)
+ 			return 1;
+ 		if (owner < rhs.owner)
+ 			return -1;
+@@ -224,9 +224,9 @@ public:
+ 	}
+ 
+ 	bool operator<(prefixes const &rhs) const {
+-		if ((uint) audit < (uint) rhs.audit)
++		if ((unsigned int) audit < (unsigned int) rhs.audit)
+ 			return true;
+-		if ((uint) rule_mode < (uint) rhs.rule_mode)
++		if ((unsigned int) rule_mode < (unsigned int) rhs.rule_mode)
+ 			return true;
+ 		if (owner < rhs.owner)
+ 			return true;
diff --git a/sys-apps/apparmor/files/apparmor-init-1 b/sys-apps/apparmor/files/apparmor-init-1
new file mode 100644
index 000000000000..37e2e6e48955
--- /dev/null
+++ b/sys-apps/apparmor/files/apparmor-init-1
@@ -0,0 +1,88 @@
+#!/sbin/openrc-run
+# Copyright 1999-2020 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+description="Load all configured profiles for the AppArmor security module."
+description_reload="Reload all profiles"
+
+extra_started_commands="reload"
+
+aa_action() {
+	local arg=$1
+	local return
+
+	shift
+	$*
+	return=$?
+
+	if [ ${return} -eq 0 ]; then
+		aa_log_success_msg $arg
+	else
+		aa_log_failure_msg arg
+	fi
+
+	return $return
+}
+
+aa_log_action_start() {
+	ebegin $1
+}
+
+aa_log_action_end() {
+	eend $1
+}
+
+aa_log_success_msg() {
+	einfo $1
+}
+
+aa_log_warning_msg() {
+	ewarn $1
+}
+
+aa_log_failure_msg() {
+	eerror $1
+}
+
+aa_log_skipped_msg() {
+	einfo $1
+}
+
+aa_log_daemon_msg() {
+	einfo $1
+}
+
+aa_log_end_msg() {
+	eend $1
+}
+
+. /usr/libexec/rc.apparmor.functions
+
+start() {
+	ebegin "Starting AppArmor"
+	eindent
+
+	if ! is_apparmor_loaded ; then
+		eerror "AppArmor kernel support is not present"
+		eend 1
+		return 1
+	fi
+
+	parse_profiles load
+
+	eoutdent
+}
+
+stop() {
+	ebegin "Stopping AppArmor"
+	eindent
+	apparmor_stop
+	eoutdent
+}
+
+reload() {
+	# todo: split out clean_profiles into its own function upstream
+	# so we can do parse_profiles reload && clean_profiles
+	# and do a proper reload instead of restart
+	apparmor_restart
+}
diff --git a/sys-apps/apparmor/files/apparmor.service b/sys-apps/apparmor/files/apparmor.service
new file mode 100644
index 000000000000..89f14fed4b77
--- /dev/null
+++ b/sys-apps/apparmor/files/apparmor.service
@@ -0,0 +1,14 @@
+[Unit]
+Description=AppArmor profiles
+DefaultDependencies=no
+After=local-fs.target
+Before=sysinit.target
+
+[Service]
+Type=oneshot
+ExecStart=/usr/share/apparmor/apparmor_load.sh
+ExecStop=/usr/share/apparmor/apparmor_unload.sh
+RemainAfterExit=yes
+
+[Install]
+WantedBy=multi-user.target
diff --git a/sys-apps/apparmor/files/apparmor_load.sh b/sys-apps/apparmor/files/apparmor_load.sh
new file mode 100644
index 000000000000..e6fe6b684317
--- /dev/null
+++ b/sys-apps/apparmor/files/apparmor_load.sh
@@ -0,0 +1,2 @@
+#!/bin/sh
+find "/etc/apparmor.d/" -maxdepth 1 -type f -exec apparmor_parser -r {} +
diff --git a/sys-apps/apparmor/files/apparmor_unload.sh b/sys-apps/apparmor/files/apparmor_unload.sh
new file mode 100644
index 000000000000..19e598bb84c4
--- /dev/null
+++ b/sys-apps/apparmor/files/apparmor_unload.sh
@@ -0,0 +1,2 @@
+#!/bin/sh
+find "/etc/apparmor.d/" -maxdepth 1 -type f -exec apparmor_parser -R {} \;
diff --git a/sys-apps/apparmor/metadata.xml b/sys-apps/apparmor/metadata.xml
new file mode 100644
index 000000000000..3390178c6521
--- /dev/null
+++ b/sys-apps/apparmor/metadata.xml
@@ -0,0 +1,13 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "https://docs.baldeagleos.com/dtd/metadata.dtd">
+<pkgmetadata>
+  <maintainer type="project">
+    <email>hardened@gentoo.org</email>
+    <name>Gentoo Hardened</name>
+  </maintainer>
+  <upstream>
+    <remote-id type="cpe">cpe:/a:canonical:apparmor</remote-id>
+    <remote-id type="launchpad">apparmor</remote-id>
+  </upstream>
+  <origin>baldeagleos-repo</origin>
+</pkgmetadata>